Skip to content
OpenAdvisories
High · 8.3 CVE-2025-1247 EUVD-2025-2099GHSA-phg3-gv66-q38x

Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance

Published Feb 13, 2025 · Updated Oct 20, 2026 · Assigned by redhat

Vendor: Red Hat Product: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 Product: Red Hat build of Quarkus 3.15.3.SP1 Product: Red Hat build of Quarkus 3.8.6.SP3 Package: io.quarkus:quarkus-rest Package: io.quarkus:quarkus-rest-deployment Ecosystem: Maven

Description

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

Affected products

VendorProductAffectedFixed
— quarkus-rest < 3.18.2 3.18.2
Red Hat Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 — —
Red Hat Red Hat build of Quarkus 3.15.3.SP1 — —
Red Hat Red Hat build of Quarkus 3.8.6.SP3 — —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.quarkus:quarkus-rest >= 3.16.0.CR1, < 3.18.2 3.18.2 GHSA-phg3-gv66-q38x
Maven io.quarkus:quarkus-rest >= 3.9.0.CR1, < 3.15.3.1 3.15.3.1 GHSA-phg3-gv66-q38x
Maven io.quarkus:quarkus-rest < 3.8.6.1 3.8.6.1 GHSA-phg3-gv66-q38x
Maven io.quarkus:quarkus-rest-deployment >= 3.16.0.CR1, < 3.18.2 3.18.2 GHSA-phg3-gv66-q38x
Maven io.quarkus:quarkus-rest-deployment >= 3.9.0.CR1, < 3.15.3.1 3.15.3.1 GHSA-phg3-gv66-q38x
Maven io.quarkus:quarkus-rest-deployment < 3.8.6.1 3.8.6.1 GHSA-phg3-gv66-q38x

Advisories 1

References